CVE-2020-37165
📋 TL;DR
CVE-2020-37165 is a buffer overflow vulnerability in AbsoluteTelnet that allows local attackers to crash the application by supplying an oversized license name. This affects users of AbsoluteTelnet 11.12 who have local access to the system. The vulnerability causes denial of service but does not allow code execution.
💻 Affected Systems
- AbsoluteTelnet
📦 What is this software?
Absolutetelnet by Celestialsoftware
⚠️ Risk & Real-World Impact
Worst Case
Local attackers can cause persistent application crashes, disrupting legitimate users' terminal sessions and potentially causing data loss in unsaved sessions.
Likely Case
Malicious local users or malware with user-level access can crash the AbsoluteTelnet application, causing temporary disruption to terminal operations.
If Mitigated
With proper access controls limiting local user privileges and monitoring for abnormal license name inputs, impact is minimal.
🎯 Exploit Status
Exploit requires local access to paste payload into license name field. Proof of concept available in exploit databases.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.13 or later
Vendor Advisory: https://www.celestialsoftware.net/
Restart Required: Yes
Instructions:
1. Download latest version from vendor website. 2. Install over existing installation. 3. Restart system or application.
🔧 Temporary Workarounds
Restrict License Management Access
windowsLimit access to AbsoluteTelnet's license management interface to trusted administrators only.
Input Validation via Group Policy
windowsImplement application control policies to monitor for abnormal license name inputs.
🧯 If You Can't Patch
- Implement strict least-privilege access controls to limit who can access AbsoluteTelnet license settings.
- Monitor application logs for crash events and investigate any abnormal license name entries.
🔍 How to Verify
Check if Vulnerable:
Check AbsoluteTelnet version in Help > About. If version is 11.12, system is vulnerable.Check Version:
Not applicable - check via application GUI Help > AboutVerify Fix Applied:
Verify version is 11.13 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crash logs from AbsoluteTelnet
- Windows Event Logs showing application failures
Network Indicators:
- No network indicators - local exploit only
SIEM Query:
EventID=1000 OR EventID=1001 Source='AbsoluteTelnet' OR ProcessName='AbsoluteTelnet.exe'